In recent years, ransomware has caused significant damage to computer systems of both consumers and enterprises. Different from other malware, ransomware fundamentally focuses on user data corruption including encryption instead of, for example, controlling and locking only the victim Operating System (OS). This unique feature in ransomware calls for checkpoint techniques for data protection. Generally, a checkpoint may allow data to be recovered to its previous “state” where the previous state, for example, represents a snapshot of the whole storage.